                      "autoscaling:DescribeScalingActivities",
                      "elasticloadbalancing:DescribeLoadBalancers"]}))
 
-
+(def full-amazon-s3-access
+  (policy {"Action" "s3:*"}))
+
+(def cloudwatch-metrics-policy
+  (policy {"Action" ["cloudwatch:GetMetricStatistics"
+                     "cloudwatch:ListMetrics"
+                     "cloudwatch:PutMetricData"
+                     "EC2:DescribeTags"]
+           "Condition" {"Bool" {"aws:SecureTransport" "true"}}}))
 
 (defn elb-listener [{:keys [port lb_port protocol lb_protocol]}]
   {:instance_port port

             (iam-role "slave-role"
                       cluster-unique
                       {:name "amazon-s3-policy"
                        :policy_arn "arn:aws:iam::aws:policy/AmazonS3FullAccess"}
                       {:name "cloudwatch-policy"
                        :policy_arn  "arn:aws:iam::aws:policy/CloudWatchLogsFullAccess"}
                       {:name "slave-eip-policy"
                        :policy (policy {"Action" ["ec2:AssociateAddress"]})}
                       {:name "slave-cloudwatch-policy"


             (cluster-resource "aws_s3_bucket" "exhibitor-s3-bucket" {:bucket (cluster-unique "exhibitor-s3-bucket")})

             (cluster-resource "aws_iam_user" "mesos-user" {:name "mesos-user"})

             (cluster-resource "aws_iam_user_policy" "mesos-user-policy-s3"
